{"id":2738742,"url":"https://alion.io/job/second-front-systems-head-of-security-compliance-authorization","title":"Head of Security Compliance & Authorization","company":{"id":58794,"name":"Second Front Systems","domain":"secondfront.com","url":"https://alion.io/company/second-front-systems","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":87,"open_postings":3,"ghost_share":0,"stale_share":0.333,"repost_share":0,"time_to_fill_p50_days":66,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Legal","role_family":"Legal","seniority":"head","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":200000,"max":215000,"currency":"USD","period":"year","gross":null,"usd_annual":215000},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"CMMC","optional":false},{"name":"FedRAMP","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-10-16T18:16:44Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-10-26T06:31:06Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":9},"description":"Head of Security Compliance & Authorization\nSecond Front Systems (2F) is seeking a Head of Security Compliance & Authorization to lead the security programs that protect our Game Warden platform and enable its use across national security environments. Reporting to the Vice President of Security, this leader will own corporate compliance programs (SOC 2, ISO, CMMC, etc.) and security authorization for the Game Warden platform (RMF/FedRAMP).. You will lead the Security Authorization team, establish priorities and operating rhythms, and ensure the organization has the processes, technical capabilities, and evidence required to support secure product delivery and maintain government authorizations.\nYou will work closely with Product, Engineering, Platform, Legal, and business leadership to integrate security throughout the product lifecycle. This includes secure architecture, application security, vulnerability management, control implementation, authorization strategy, assessment readiness, and continuous monitoring.\nThis is a leadership role for someone who can build durable programs, develop high-performing teams, and bring structure to complex security and compliance requirements. The successful candidate will understand both cloud-native engineering and government authorization, with the judgment to balance mission delivery, customer commitments, technical risk, and regulatory expectations.\nNote: Candidates must reside in our DC/Maryland/Virginia hiring hub\nThis is a full-time position.\nWhat You'll Do\nLead the Security Authorization and Compliance team.\nEstablish the product security and compliance strategy for Game Warden in alignment with the company’s business objectives, product roadmap, customer commitments, and enterprise security strategy.\nDefine ownership and operating processes for security authorization and continuous monitoring, including the handoffs with Engineering and Security Operations.\nBuild a security roadmap that identifies capability gaps, required investments, staffing needs, technical dependencies, and measurable outcomes.\nProvide leadership oversight for security authorization packages supporting Department of Defense, federal, and other national security environments.\nEnsure authorization packages, control implementations, assessment evidence, POA&Ms, and continuous monitoring activities remain accurate, current, and defensible.\nEstablish the standards and quality controls used by Security Authorization Specialists to manage eMASS packages, DISA PPSM registrations, assessment evidence, findings, and authorization documentation.\nDirect readiness activities for security assessments, third-party reviews, government audits, and authorization decisions. Ensure teams address issues before they become assessment blockers.\nOwn the corporate audit calendar.\nPartner with Engineering and Product leadership to integrate security requirements into product planning, architecture decisions, release processes, and engineering priorities.\nTrack and report vulnerability/configuration findings against authorization and compliance impact of significant changes.\nReview significant product and infrastructure changes to determine their effect on security controls, authorization boundaries, inherited services, customer commitments, and existing approvals.\nCreate a coordinated compliance approach across applicable frameworks, including DoD RMF, FedRAMP, CMMC, SOC 2, ISO standards, and other customer or market requirements.\nReduce duplicate work by establishing reusable controls, shared evidence, common documentation, and cross-framework mappings.\nExpand the use of automation for control validation, evidence collection, continuous monitoring, compliance reporting, and authorization-package maintenance.\nEstablish meaningful metrics for product risk, vulnerabilities, remediation performance, assessment readiness, POA&M health, authorization milestones, and program capacity.\nProvide the Vice President of Security and executive leadership with clear reporting on material risks, program status, resource constraints, and decisions requiring leadership attention.\nManage relevant vendors, assessment partners, penetration testing providers, and GRC technology investments.\nCoordinate with Security Operations and Incident Response teams when events affect authorizations or attestations.\nWhat You Bring\nHave 10+ years of progressive cybersecurity experience, including significant responsibility for product security, cloud security, security engineering, compliance, or government authorization programs.\nFive or more years of experience leading cybersecurity professionals, with demonstrated success setting priorities, developing talent, managing performance, and scaling teams.\nExperience owning security programs for a cloud platform, software-as-a-service product, platform-as-a-service environment, or similarly complex technology organization.\nDemonstrated success integrating security into product development and engineering workflows without creating unnecessary barriers to delivery.\nStrong knowledge of application security, cloud security architecture, vulnerability management, secure software development, and software supply chain risk.\nPractical understanding of AWS, Kubernetes, containers, CI/CD pipelines, infrastructure as code, identity and access management, logging, observability, and cloud-native security patterns.\nExperience establishing or governing application security capabilities such as SAST, DAST, software composition analysis, secrets detection, container scanning, and penetration testing.\nDirect experience with government security authorization programs, including NIST SP 800-53, NIST SP 800-37, DoD RMF, FedRAMP, or comparable federal requirements.\nExperience overseeing the development, assessment, authorization, and continuous monitoring of complex authorization packages.\nFamiliarity with eMASS, DISA PPSM, DISA STIGs, SCAP Compliance Checker, ACAS, IAVM requirements, and the DISA Cloud Computing Security Requirements Guide.\nExperience leading formal assessments and working with Security Control Assessors, third-party assessment organizations, government sponsors, and Authorizing Officials.\nThe ability to evaluate technical risk, understand competing priorities, and make sound decisions when requirements, timelines, or ownership are unclear.\nStrong written and verbal communication skills, including the ability to explain technical and regulatory issues to engineers, customers, assessors, and executives.\nExperience defining program metrics, presenting risk to senior leadership, and using data to guide staffing, investment, and remediation decisions.\nDemonstrated ability to build repeatable processes and operating structures in a fast-moving environment.\nCISSP or an equivalent advanced cybersecurity certification required.\nMust meet applicable DoD 8140 qualification requirements for the assigned work role.\nPreferred\nActive TS/SCI clearance or current eligibility.\nExperience supporting DoD Impact Level 4 or Impact Level 5 cloud environments.\nExperience leading FedRAMP Moderate or FedRAMP High authorization and continuous monitoring programs.\nExperience with Kubernetes-based DevSecOps platforms or multi-tenant cloud environments supporting government customers.\nFamiliarity with CMMC, SOC 2, ISO 27001, ISO 20000-1, Cyber Essentials Plus, or international security assurance requirements.\nExperience implementing automated control testing, compliance as code, or continuous evidence collection.\nExperience developing a common control framework that supports multiple authorization and certification programs.\nExperience managing third-party assessors, penetration testing providers, GRC platforms, and security technology vendors.\nAdvanced certifications such as CISM, CCSP, CSSLP, PMP, or CGRC.\nPrior experience supporting national security, defense, intelligence, or other highly regulated customers.\nA strong commitment to Second Front Systems’ mission of accelerating the secure delivery of mission-critical software to the U.S. government. The base salary for this position will fall between $200,000 and $215,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.\nSuccess at 2F Looks Like:\nA proactive and solutions oriented mindset\nViewing obstacles as opportunities for growth\nHaving a bias toward action and tangible, measurable results\nBeing team-oriented with a focus on personal responsibility and autonomy\nPerks & Benefits:\nThis role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful-both in- and outside the workplace.\nPerks of Joining Our Team:\nCompetitive salary\n100% employer-paid medical, dental, and vision coverage for you and your dependents\n401(k) with a 3% company contribution\nComprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more\nEquity incentive plan\nNew hire technology and home office stipend\nAnnual professional development stipend\nFlexible paid time off, plus all federal holidays\nGenerous parental leave\nFlexible remote work opportunities\nEmployee referral bonus program\nVisit our careers page to learn more.\nWho We Are:\nSecond Front Systems (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.\nOne last thing:\nWe are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.\nAre you ready to join our team:\nTo apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.\nState notices:\nColorado:\nIn accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.\nMaryland:\nUnder Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.","description_format":"text","description_chars":11441,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":["Equity","Home office","Parental leave","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Virginia","iso":null,"kind":"city"},{"name":"Maryland","iso":null,"kind":"city"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Security Compliance","Digital Government"],"lifecycle":[{"event":"open","at":"2026-10-16T19:59:06Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":9,"expected_fill_days":66,"reasons":["conf:3","win:early"],"computed_at":"2026-10-26T05:57:25Z"},"pay":{"stated_usd_annual":215000,"is_top_pay":false},"html_url":"https://alion.io/job/second-front-systems-head-of-security-compliance-authorization","json_url":"https://alion.io/job/second-front-systems-head-of-security-compliance-authorization.json","meta":{"generated_at":"2026-10-26T06:46:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9113,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":58794},"rest":"https://alion.io/mcp/rest/get_company?id=58794"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsecond-front-systems-head-of-security-compliance-authorization"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsecond-front-systems-head-of-security-compliance-authorization"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsecond-front-systems-head-of-security-compliance-authorization"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/second-front-systems-head-of-security-compliance-authorization\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsecond-front-systems-head-of-security-compliance-authorization"}]}